oscerd commented on issue #731:
URL: https://github.com/apache/camel-karaf/issues/731#issuecomment-5400587477
Items 1 (pin the action) and 3 (wrapper checksums) are done in #736.
**Item 2 (remove the root `<repositories>` block) should not be done as
described** — I checked it before writing the patch and it would break the
build:
- `features/src/main/feature/camel-features.xml:1996-2002` lists
`com.atlassian.jira:jira-rest-java-client-core` / `-api`,
`com.atlassian.sal:sal-api`, `com.atlassian.event:atlassian-event` and
`com.atlassian.httpclient:*` as bundles of the `camel-jira` feature, and
the
`features` module runs `karaf-maven-plugin:verify`, so those coordinates
have
to resolve during the build.
- `features/pom.xml` does not declare the Atlassian repository — it relies on
inheriting it from the root POM.
- None of those artifacts are published to Maven Central (every
`maven-metadata.xml` probe returns 404), so removing the root declaration
leaves no way to resolve them.
So `components/camel-jira` is *not* the only module that needs the
repository;
that was the wrong premise in the issue description above.
The change that would still achieve the intent — narrowing the inherited
surface from every module in the reactor down to the ones that actually need
it — is to **move** the declaration rather than delete it: keep it in
`components/camel-jira`, add it to `features`, and drop it from the root.
That
wants a full reactor build to confirm nothing else resolves an Atlassian
coordinate, which is why I have not bundled it into #736.
Worth noting the security value here is modest either way: `maven-external`
is
a curated proxy that an attacker cannot publish to, the declaration is HTTPS,
and snapshots are disabled. Happy to do the move as a follow-up if you think
it is worth the reactor build to verify.
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
